Site Is Down But DNS Looks Fine: A Diagnostic Checklist

Step 1: Confirm DNS Actually Resolves

Query the domain directly and check it returns the IP address you expect. If it doesn't resolve at all, or returns NXDOMAIN or SERVFAIL, the problem genuinely is DNS — see our guide to fixing those errors specifically, rather than continuing down this checklist.

Step 2: Check Propagation If Something Recently Changed

If a DNS record was changed recently, some resolvers around the world may still be serving the old, cached answer while others already have the new one. Check propagation across many resolvers before concluding a fix didn't take effect — it may simply not have reached everywhere yet.

Step 3: Test Server Reachability, Independent of DNS

Once DNS resolves correctly, the question shifts entirely away from DNS. Connect directly to the IP address DNS returned, bypassing the domain name entirely — this isolates whether the remaining problem has anything to do with DNS at all, or is purely a network or server issue from here on.

Step 4: Check the Actual Port, Not Just Whether the Host Responds

A host can be reachable — answering ping, for instance — while the specific service on port 443 or port 80 is down, misconfigured, or blocked by a firewall rule that doesn't affect other traffic. Confirm the actual port the site should be running on is open and answering.

Step 5: Check the TLS Certificate

An expired or mismatched certificate presents as a dead or broken site in a browser even when DNS, the network path and the web server are all completely fine — this is one of the most common causes mistakenly reported as a DNS problem.

Why Order Matters

Each step rules out one entire layer before the next one is worth checking — there's no point debugging TLS on a server that isn't reachable yet, or reachability on a domain that isn't resolving. Working in order turns a vague "it's down" into a specific, fixable cause.

Run the Full Diagnostic Automatically